sozvezdital[.]ru

Analysis of the domain sozvezdital.ru shows a recent registration (July 14, 2026) through the registrar DOMAINSHOP-RU and DNS delegation to the Cloudflare nameservers kami.ns.cloudflare.com and rohin.ns.cloudflare.com. The domain resolves to the IPv4 address 188.114.97.3, which is currently listed on a single public security blocklist and has been actively blocked by the PhishDestroy platform. VirusTotal records indicate that the domain has been examined by 95 scanning vendors, none of which have reported a detection at the time of assessment; this absence of detections does not constitute a safety verdict.

The threat type is identified as generic phishing, suggesting the site is likely employed for credential harvesting, though the specific page content, HTTP status, SSL certificate details, and page title have not been publicly disclosed. The domain remains active, and its risk status is noted as under investigation.

Defenders should consider immediate DNS-level blocking of sozvezdital.ru and its associated IP address, incorporate the domain into existing phishing and malicious‑URL blocklists, and monitor network traffic for connections to 188.114.97.3. Ongoing surveillance of the registrar and nameserver activity is advised to detect any further infrastructure changes that could indicate escalation or the deployment of additional malicious services.